Eigma
EN 中 DE
How AI Changed Fraud Open Eigma
Contents Shared secrets

Verification and authentication

Shared secrets

A prearranged family phrase is a narrow check on a claimed identity. It can ask for information selected before an emergency contact rather than relying on a voice, image, or public biographical detail. The FBI recommends creating a secret word or phrase with family members in its warning about AI-generated voice messages.1

The distinction between a prearranged phrase and an improvised personal question matters. The FTC suggests asking an unexpected emergency caller a question only the real relative or friend should answer, but it also warns that scammers may obtain personal details from social media or a hacked family email account.2 A birthday, school, pet name, or similar fact may therefore be a weak choice if it is discoverable.

The table separates the situations in which shared information may be presented as a check.

Situation Information checked Main limit
Unexpected family emergency Prearranged family phrase The phrase can be disclosed
Improvised personal check Detail the real person should know The detail may be discoverable
Digital account login Security-question answer It is not an acceptable digital authenticator

NIST rejects knowledge-based security questions as digital authenticators because answers may be discoverable and many questions have few possible answers.3 That institutional finding does not establish that an informal family phrase has exactly the same weaknesses. It does show why a familiar fact should not be treated as a durable account credential.

A family phrase should also remain separate from account passwords and one-time authentication codes. NIST notes that an attacker who obtains a shared secret can often impersonate its owner, and that social engineering can persuade someone to disclose an authentication secret.4 The FBI separately advises against providing an account's two-factor authentication code by email, text, or encrypted messaging.1

Family secret-word advice is untested. The fetched sources contain no field or controlled evaluation measuring whether it prevents consumer losses involving cloned voices.

Boundary. A correct phrase supports only the identity question it was designed to check. It does not prove that an emergency occurred, that payment instructions are legitimate, or that an account is secure. Its value also falls if the phrase is disclosed. The available guidance does not specify how households should generate, store, rotate, or revoke such phrases.

References

  1. [1]FBI warning on impersonation and AI-generated voice messages
  2. [2]FTC guidance on fake family emergencies
  3. [3]NIST digital identity frequently asked questions
  4. [4]NIST guidance on threats to authentication secrets
Quizzes

  1. During an unexpected family-emergency call, which response relies on information deliberately agreed before the call?

    • Ask for the family's prearranged phrase
    • Ask an improvised private question
    • Call back through a previously known number

    The family phrase was selected in advance. An improvised question is a knowledge check, while a callback verifies through a separately chosen channel.

  2. A family verification phrase should be treated as ____.

    • a narrow check on claimed identity
    • a replacement for account authentication
    • proof that the requested payment is safe

    The phrase addresses who may be speaking, not whether the story or requested transaction is legitimate.

Comments

No comments yet. Start the conversation.